Ibrahim Abdlrazik 🇪🇬🦅🇪🇬

#DFIR #ThreatHunting #DetectionEngineering
#Sigma #Yara
#ThreatIntelEnthusiast
#BlueTeam
#Egyptian 🇪🇬

[Team Cymru Research @teamcymru_S2]

INTEL DROP

Generative-AI tooling has moved into the malicious hosting world. In the Total Insights Feed, self-hosted AI stacks (AI agents, LLM front-ends, MCP servers, AI code-audit and API-gateway tools) keep turning up on the same hosts as C2, bulletproof hosting, and recon/offensive tooling.

Same-host overlaps observed:
54.173.210.5 — gen-ai:mcp-server + metasploit
54.179.87.129 — gen-ai:mcp-server + metasploit
54.218.111.116 — gen-ai:mcp-server + metasploit
188.239.22.26 — gen-ai:sub2api + sliver
101.200.34.196 — gen-ai:deepaudit + vshell
57.129.119.130 — gen-ai:n8n + overlord-rat
57.129.100.65 — gen-ai:open-webui + gophish
143.20.149.57 — gen-ai:openclaw + ost:arl
142.93.48.137 — gen-ai:n8n + scanner:brute-force
101.126.23.91 — gen-ai:new-api + ost:arl

Attackers are now running AI tooling as part of their own kit, on the same boxes as their C2.

#TotalInsights #ThreatIntel #GenAI #AI

https://t.co/nDqrsELahM

[TrustedSec @TrustedSec]

Device code phishing is quietly becoming one of the more effective techniques targeting #M365 environments. In our latest #blog, Lumi Taiwo and Danny Dubree detail how it works and the #ConditionalAccess controls that shut it down. Read it now! https://t.co/eMk45P56cQ

[John Lambert @JohnLaTwC]

If you use #KQL to hunt for attacks, this post is for you.
I want to tell you about a powerful new operator you can use to hunt: the lift operator.

[Thomas Roccia 🤘 @fr0gger_]

💥 Supply chain nightmare continues! Axios a widely used HTTP client got compromised.

Malicious versions:
- axios 1.14.1 (latest)
- axios 0.30.4 (legacy)
- plain-crypto-js 4.2.x (postinstall backdoor)

NPM supply chain attacks are becoming more common, so I put together a short cheat sheet you can keep around to secure your pipeline.

[MagicSword @magicswordio]

This is a really interesting concept for anyone focused on detection: https://t.co/LrgWjXL0eC
Detection chokepoints today are exactly where defenders should be focusing a spotlight at.

EDR bypass ➡️ https://t.co/GQYFpObADC
https://t.co/gO0vkZm6vK

Renamed RMMs ➡️ https://t.co/nr8hZE3Zcy
https://t.co/rO03zrYYBa

You’ll notice some clear parallels with what we’re doing at https://t.co/KvSSji8GVD these are exactly the execution paths we focus on preventing.

[Pierre Le Bourhis @plebourhis]

We’ve mapped the TTPs, infrastructure, and the move from RATs to custom Python-based stealers.

Full analysis and indicators here: https://t.co/uvlbDDG64k

@tdatwja @JAMESWT_WT
#ThreatIntel

[DFIR Radar @DFIR_Radar]

TeamPCP's sophisticated supply chain attack cascaded from Trivy to Checkmarx, weaponizing GitHub Actions and CI/CD credentials to spread across multiple vendors. The campaign demonstrates how stolen CI tokens enable lateral movement between trusted ecosystems.

Key technical details:
- CVE-2026-33634: Malicious v0.69.4 Trivy tag pushed using spoofed commits and backdated timestamps
- Compromised Actions: checkmarx/ast-github-action, checkmarx/kics-github-action harvest runner secrets to tpcp.tar.gz
- C2 Infrastructure: checkmarx[.]zone, scan.aquasecurtiy[.]org (45.148.10.212), Cloudflare tunnels
- Fallback exfiltration creates docs-tpcp repos using victim's GITHUB_TOKEN
- Malicious OpenVSX extensions: ast-results v2.53.0, cx-dev-assist v1.7.0 via compromised ast-phoenix account

Attack methodology:
- Initial access via February 27 "Pwn Request" exposed Trivy service account token
- March 19-24 escalation: poisoned GitHub releases → stolen CI credentials → cross-vendor pivot
- CanisterWorm auto-propagated across 28+ npm packages using stolen publish tokens
- Iran 🇮🇷-targeted destructive payload: rm -rf / on systems matching Asia/Tehran timezone

DFIR artifacts:
- Hunt systemd services: pgmon.service, pgmonitor.service, internal-monitor.service
- K8s DaemonSets: host-provisioner-std, host-provisioner-iran in kube-system namespace
- Process memory scraping via /proc/[pid]/mem targeting Runner.Worker processes
- Steganography in v3.

#DFIR_Radar

[DeepLearning.AI @DeepLearningAI]

Many people start learning AI by reading about it.

But the real shift happens when you start building.

Going from understanding AI to creating applications usually happens step by step: first understanding how generative AI works, then learning the programming behind it, then working with LLMs, and eventually building full AI systems.

Here are a few courses that walk through that path:

Generative AI for Everyone
https://t.co/TOhuqjAK2B

AI Python for Beginners
https://t.co/DjETJ84LFA

ChatGPT Prompt Engineering for Developers
https://t.co/MwKJdkiUy3

LangChain for LLM Application Development
https://t.co/MeR3pMKA7r

Agentic AI
https://t.co/jJkt1T6Dvu

A practical path from learning AI to building with it.

Share it with someone starting their AI journey.

[Microsoft Threat Intelligence @MsftSecIntel]

The cybercriminal threat actor tracked by Microsoft Threat Intelligence as Storm-2561 is running an SEO-poisoning campaign that redirects people searching for enterprise VPN software to spoofed sites and malicious ZIP downloads leading to credential theft. https://t.co/KzTN7J6Rck

The ZIP file contains a malicious, digitally signed installer that masquerade as a trusted VPN client. The attack chain ultimately loads a variant of Hyrax infostealer that captures VPN sign-in credentials and VPN configuration data, and exfiltrates it to attacker infrastructure.

Read the full Microsoft Defender Experts analysis of the tactics, techniques, and procedures (TTPs) and indicators of compromise of this Storm-2561 campaign, and get protection, detection, and hunting guidance:

[Muhammad Ayan @socialwithaayan]

🚨 NEW STUDY: Microsoft Research and Carnegie Mellon just surveyed 319 knowledge workers across 936 real AI use cases.

The finding they buried in the data is the most important thing written about AI and the workplace this year.

The more you trust AI, the less your brain actually engages.

Not a theory. A measured inverse correlation across hundreds of real professional tasks.

Here is how the study worked.

319 knowledge workers documented 936 actual instances of using generative AI in their real jobs. Not lab tasks. Not hypothetical scenarios. Real work they did that week. For each use case they reported the task type, the stakes involved, how much they trusted the AI output, how much critical thinking they applied, and how much cognitive effort they felt the task required.

Three findings came back that nobody in the productivity space wants to talk about.

Finding one: trust in AI directly predicted less critical thinking.

The workers who expressed high confidence in AI outputs applied significantly less scrutiny to those outputs. They accepted more. They questioned less. They moved on faster. The correlation held across task types, industries, and experience levels.

The inverse was also true. Workers with higher confidence in their own abilities thought more critically when AI was involved, not less. They used AI as a starting point and interrogated it. The people most likely to use AI well were the people who trusted themselves more than the tool.

Finding two: the danger zone is routine tasks, not high-stakes ones.

For high-stakes decisions, workers actually reported more cognitive effort when using AI than without it. Verification anxiety kicked in. They checked the output. They second-guessed. They cross-referenced.

For routine, everyday tasks, effort collapsed.

Workers reported significantly less cognitive engagement for the ordinary work that makes up the majority of most people's days. Summarising. Drafting. Responding. Reviewing. The tasks people do dozens of times a week.

They were on autopilot.

And routine tasks are exactly where AI is used most.

Finding three: knowledge work is shifting from creation to critical integration.

The researchers describe a structural change in what knowledge workers actually do now. The job is no longer generating the work. It is reviewing, editing, and integrating AI output.

But the study found that a large portion of workers are skipping the critical part of critical integration.

They are doing integration without criticism. Accepting without interrogating. Publishing without owning.

The output looks professional. The thinking never happened.

Here is what makes this finding different from the MIT brain scan study or the belief offloading paper.

This is not about students. This is not about casual users.

This is 319 professionals doing their actual jobs.

Lawyers. Analysts. Engineers. Writers. Managers.

People who are paid specifically because they are supposed to think.

And the data shows that the routine, repeated use of AI in professional work is producing the exact opposite of what everyone promised.

Not augmented thinking. Replaced thinking.

Not sharper judgment. Deferred judgment.

Not more productive professionals. More efficient output generators who are gradually losing the habit of scrutinising what they produce.

The researchers call the new mode of knowledge work critical integration.

The honest version of what the data shows is closer to this:

We built a tool that does the creative work.
We told people to focus on the critical review.
Most people skipped the review.
And the more they trust the tool, the less likely they are to ever do the review at all.

The uncomfortable question for every knowledge worker reading this:

When did you last genuinely interrogate an AI output before using it?

Not skim it. Not feel like it seemed right.

Actually question it the way you would question a junior colleague who had a track record of sounding confident while being wrong.

The study suggests the answer for most people is: not recently.

And the more comfortable you have become with AI, the less recently it probably was.

[Black Hills Information Security @BHinfoSecurity]

IR plans are often too long and unnecessarily complex.

Let’s simplify your Incident Response Plan and focus on the phases that matter most: identification, containment, and eradication.

Read and download The Infosec Survival Guide: ORANGE BOOK - Incident Response here -- https://t.co/tjjri1eACw

Order your FREE copy of The Infosec Survival Guide: ORANGE BOOK - Incident Response here - https://t.co/wDtQkFPgPa

Learn more from Patterson C.:
Do it, do it NOW! - A Pre-Incident Checklist  - https://t.co/VUXCLp3SnA

[Stephen Sims @Steph3nSims]

I want to share a quick thought for people in cyber security. This will be my longest tweet ever.

I’ve spoken to many lately who are having an existential crisis from the constant posts about “the end of cybersecurity jobs.”

Yes, things are changing quickly. This is a significant moment for the tech industry. Change can be uncomfortable. But we’ve seen cycles like this before.

• When GitHub and open source took off, people said software engineers would disappear because code was free.
• When AWS and cloud computing emerged, people said infrastructure jobs would vanish.
• When fuzzing and SAST tools improved, people said vulnerability research would disappear.
• Virtualization would eliminate infrastructure jobs.
• Mobile computing was going to end desktop dev.
• Exploit mitigations would end exploitability. It didn't.

Each time automation improved, the amount of software grew faster than the automation. It does feel "different" this time as it's explosive.
Some roles will shrink:
• repetitive pentesting
• basic vulnerability scanning
• tier-1 SOC monitoring

But other areas are expanding rapidly:

• AI system security
• supply chain security
• identity architecture
• autonomous agent security
• critical infrastructure protection

Historically, every time we eliminate one class of bugs, new classes emerge. Right now people are vibe-coding entire systems, giving AI access to their machines, crossing trust boundaries, and deploying autonomous agents with excessive permissions. The legal and regulatory world is nowhere close to ready.

There will absolutely be new failure modes. Humans are amazing and always adapt, finding new ways to do things.

The worst thing you can do right now is fall into a doom loop.

...and I’ll be honest, I too have felt the "psychological paralysis" a few times thinking, “Is this time different?” It's especially impactful when it comes from someone I respect in the community. There are certainly unknowns, in an industry where we've become accustomed to predictability.

But... the majority of those reactions are usually driven by social media, not reality. Platforms like X reward engagement, and sensational doom posts spread faster than measured thinking.
If you see something like:
“Holy #$%^! Opus 66.6 just found every bug in Chrome and replaced 50 startups!”

…mute it and move on.

Instead:

Stay curious.
Learn the new technology.
Adapt your skillsets.
Build things.

We’ll get through this transition the same way we always have. If I'm wrong then Sam Altman better be right about UBI! :) I'm sure that if this tweet gets any engagement that I'll get some heat for it, but a good friend of mine reminds me often to focus on what you have control over. I'll revisit this tweet at DEF CON 40!

[MagicSword @magicswordio]

Attackers don’t need stolen certificates. They only need 8 bytes. By flipping 4 bytes in the PE checksum and 4 in the certificate padding, they generate 2⁶⁴ unique driver hashes while keeping Microsoft’s digital signature valid.

Why it matters:
- Those 8 bytes sit outside the region Windows verifies.
- Every variant looks “signed and trusted.”
- Hash-based blocking becomes useless overnight.

That’s how TrueSightKiller evolved into 2,500+ signed variants. All trusted by Windows, all capable of killing EDRs in seconds.

Check out: https://t.co/8ldbtHVJBa

[Clandestine @akaclandestine]

https://t.co/m3F5OAMTk8
some researchers were able to obtain the data of around 200 slop apps that were leaking data. the biggest (Chat & Ask AI by Codeway) has over 1.000.000 downloads and 406.033.606 records are available - just from that one app. they were able to obtain messages including voice mails, real names, mail addresses, prompts, responses and more from all these apps. also user ids, ai tokens, user tokens, timestamps and more
obv ppl downloaded these apps to create csam and more.
journalists and researchers can request access

[DarkFeed @ido_cohen2]

⚠️ New Intelligence: Ransomware Groups Targeting Negotiators

The Everest ransomware group has publicly "blacklisted" a recovery service, threatening to leak sensitive negotiation logs.

This marks another instance of "Negotiator Shaming," a tactic previously used by groups like LockBit and Royal. Threat actors are increasingly hostile toward intermediaries, accusing them of stalling or "scamming" both the victim and the attacker.

🔗 Full Report: https://t.co/aj3TMnEYNd
#CyberSecurity #Ransomware #Everest #ThreatIntel #Negotiation

[The Haag™ @M_haggis]

📦 I just released Security-Detections MCP
- a way to let LLMs reason over real detection content, not just the internet.

This isn’t "AI writes detections for you."

It’s:
• Threat report in
• Coverage + gaps out
• Grounded in actual rules (KQL, SPL, Sigma, internal content)
The MCP indexes your detection corpus and exposes it in a way LLMs can query, compare, validate, and explain.

What this enables:
• Faster detection validation
• Identifying blind spots before adversaries do
• Structured markdown reports you can actually act on
• Humans stay in control — AI becomes the force multiplier

Repo ➡️ https://t.co/hF5mrvTJkT
👇Video walkthrough 👇 https://t.co/lp5MW3r6ur

If you’re doing detection engineering, threat hunting, or maintaining a large rule set - this changes how fast you can move.

More coming. This is just the start.

[R136a1 @TheEnergyStory]

This blog post provides an in-depth analysis of #Turla's #Kazuar v3 loader and how it tries to slip past modern defenses:

• Sideloading via MFC satellite DLLs
• Control flow redirection trick (+ POC)
• Patchless ETW and AMSI bypasses (+ POC)
• Extensive COM usage for registry, file and folder operations (+ partial POC)
• Strings encryption (+ IDAPython decryption script)
• Including IOCs and Yara rules

https://t.co/FK8uAq9iyK

[lazarusholic @lazarusholic]

"Hunting Lazarus: Inside the Contagious Interview C2 Infrastructure" published by @_redasgard. #ContagiousInterview, #Lazarus, #DPRK, #CTI https://t.co/hwrSQS5gW8

[CloudBreach @Cloud_Breach]

🚨 New Attack Alert: #ConsentFix 🚫🔑
A new technique discovered by Push Security bypasses MFA & Passkeys by tricking users into manually handing over OAuth tokens.

The Attack Flow:
1️⃣ Phish site asks for "verification"
2️⃣ User logs into legit Microsoft Azure CLI
3️⃣ User COPIES "localhost" URL w/ auth code
4️⃣ User PASTES it back to attacker 🎣
Result: Full session hijack. 🔓

⚠️ Tip: Never copy-paste address bar URLs for "verification"!

#CloudBreach #InfoSec #AzureSecurity #Phishing #Microsoft365 #CyberSecurity #RedTeam #BlueTeam #EntraID #MFA #IdentitySecurity #SocialEngineering #ThreatHunting #SecOps #OauthAbuse #TokenTheft #CISO

[Check Point Research @_CPResearch_]

Check Point Research unveils #VoidLink, a highly modular Linux malware framework with 30+ plugins, cloud/container persistence, robust OPSEC (runtime encryption, rootkits, self-delete), and links to Chinese-affiliated actors. Full analysis on our blog
https://t.co/9ucKf6eyGC